199 results · Clear filters · Feed
-
Critical max 9.9VDE-2026-001 1 CVE
METTLER TOLEDO: ASP.NET core vulnerability in LabX
LabX 21.2.12 (formerly known as LabX Cloud 1.2.12) is affected by the ASP.NET core vulnerability CVE-2025-55315.
-
Critical max 9.8
Carlo Gavazzi Controls: Multiple Vulnerabilities in Controller UWP 3.0
The UWP 3.0 family of Monitoring Gateways and Controllers and the CPY Car Park Server are affected by multiple vulnerabilities in their set-up software, runtime firmware, embedded Web interface.
first Sep 26, 2022 -
Critical max 9.8
Several CODESYS vulnerabilities in Festo Automation Suite
Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwar…
-
Critical max 9.8
Festo: Several vulnerabilities in FactoryViews
FactoryViews bundles many third-party applications which are used in background processes to provide the software's features. From time to time, vulnerabilities in these bundled applications are discovered. These are typically fixed in newer versions of Facto…
first Jul 10, 2023 -
Critical max 9.8
ifm moneo password reset can be exploited
moneo \"Forgot Password\" function has a vulnerability which allows gaining privileged access.
first May 6, 2024 -
Critical max 9.8
ifm: Vulnerabilities in ifm AC14 firmware
In ifm Smart PLC firmware up to version 4.3.17 for Smart PLC controllers AC14xx and AC4xxS, an attacker can access the configuration by using the hardcoded credentials. The endpoint hosts a scripts capable of executing various commands.
first Jul 9, 2024 -
Critical max 9.8
IFM: weak password recovery vulnerability in moneo appliance
An unauthenticated remote attacker could reset the administrator's password with information from the default, self-signed certificate.
first Dec 12, 2022 -
Critical max 9.8VDE-2025-105 1 CVE
Endress+Hauser: Multiple products affected by Wibu-Systems CodeMeter Vulnerability
A vulnerability in Wibu-Systems CodeMeter (up to version 7.60b) affects multiple Endress+Hauser products. This flaw can lead to a heap buffer overflow, which may allow remote code execution under certain conditions.
-
Critical max 9.8
Several Vulnerabilities in MES PC (Windows 10)
MES PCs shipped with Windows 10 come pre-installed with XAMPP. XAMPP is a bundle of third-party open-source applications including the Apache HTTP Server, the MariaDB database and more. From time to time, vulnerabilities in these applications are discovered. …
first Feb 27, 2024 -
Critical max 9.8VDE-2025-097 5 CVEs
METZ CONNECT: Config API – Authentication bypass leads to admin takeover in EWIO2 series
A critical authentication bypass in EWIO-2 allows unauthenticated attackers with network access to gain administrative control over the device. Once compromised, an attacker can change configurations, manipulate data, disrupt services, and potentially render …
-
Critical max 9.8
Festo: Siemens S7-1500/ET200SP CPU used in Festo Didactic products contains a memory protection bypass vulnerability
Siemens SIMATIC S7-1200 and S7-1500 CPUs contained in various Festo Didactic products contain a memory protection bypass vulnerability that could allow an attacker to write arbitrary data and code to protected memory areas or read sensitive data to launch fur…
first Sep 9, 2024 -
Critical max 9.8
Festo: Controller CECC-S,LK,D family <= 2.3.8.1 - multiple vulnerabilities in CODESYS V3 runtime system
The Festo controller CECC product family is affected by multiple vulnerabilities in the CODESYS V3 runtime.
first Jul 18, 2022 -
Critical max 9.8
Festo: Incomplete documentation of remote accessible functions and protocols in Festo products
Incomplete Festo product documentation of remote accessible functions and their required IP ports. Depending on the product a description of the supported features can be found in the product documentation to some extent. Update A, 2022-12-13 Added affected d…
first Nov 29, 2022 -
Critical max 9.8
Festo: Multiple Festo products contain an unsafe default Codesys configuration
The products are shipped with an unsafe configuration of the integrated CODESYS Runtime environment. In this case no default password is set to the CODESYS PLC and therefore access without authentication is possible. With a successful established connection t…
first Nov 29, 2022 -
Critical max 9.8VDE-2025-087 2 CVEs
WAGO: Vulnerabilities in Device Sphere and Solution Builder
Due to a missing authentication check, the WAGO Solution Builder and the WAGO Device Sphere are vulnerable to a potential information exposure.
-
CriticalVDE-2025-080 1 CVE
WAGO: Multiple Vulnerabilities in I/O-Check Service
A missing authentication vulnerability exists in the iocheckd service "I/O-Check" functionality. A single packet can cause a denial of service and weaken credentials resulting in the default documented credentials being applied to the device. An attacker can …
-
Critical max 9.3
WAGO: Critical sudo Vulnerability in Multiple Products
A vulnerability in sudo allows a low privileged attacker to execute commands with root rights.
-
Critical max 9.8
Weidmueller: Industrial ethernet switches are affected by multiple vulnerabilities
Weidmueller industrial ethernet switches are affected by multiple vulnerabilities. Weidmueller has released new firmwares of the affected products to fix the vulnerabilities.
first May 27, 2025 -
Critical max 9.8
Pepperl+Fuchs: Anonymous FTP server and Telnet access allows information disclosure and manipulation
Critical vulnerabilities has been discovered in the product, mainly caused by ananonymous FTP server and Telnet access.The impact of the vulnerabilities on the affected device may result in Information disclosure Denial of service Device manipulation
first Jul 10, 2024 -
Critical max 9.1
Vulnerabilities in mbCONNECT24/mymbCONNECT24
The data24 service that is bundled with every installation of mbCONNECT24/mymbCONNECT24 has two serious flaws in core components. These combined can lead to a complete loss of confidentiality, integrity and availability.
first Mar 18, 2025 -
Critical max 9.8
MB connect line: Multiple Vulnerabilities in mbNET.mini Product
Multiple vulnerabilities have been discovered in MB connect line mbNET.mini product allowing for RCE or unauthorized file access.
first Oct 15, 2024 -
Critical max 9.8
Helmholz: Multiple Vulnerabilities in Helmholz REX100 Product
Multiple vulnerabilities have been discovered in REX100 allowing for RCE or unauthorized file access.
first Oct 15, 2024 -
Critical max 9.8VDE-2025-076 1 CVE
Welotec: Hard-coded JWT secret in egOS WebGUI
A hard-coded JWT secret in the egOS WebGUI backend is readable to the default user, allowing attackers to forge valid tokens and access protected API endpoints.
-
Critical max 9.1
Frauscher: FDS101, FDS-SNMP101 and FDS102 for FAdC/FAdCi are Vulnerable to OS Command Injection Vulnerability
Frauscher Sensortechnik FDS101, FDS-SNMP101 and FDS102 for FAdC/FAdCi R2 and all previous versions are vulnerable to OS Command Injection via malicious configuration file. CVE-2025-3626 affects FDS102 versions v2.8.0 < v2.13.3. CVE-2025-3705 affects a broader…
first Jul 7, 2025 -
Critical max 9.8
Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers
Multiple vulnerabilities in the firmware of CHARX SEC-3xxx charging controllers have been discovered. **Update Version 1.1.0:** Updated the reporting credits for CVE-2025-25271.
first Jul 8, 2025 -
Critical max 7.2VDE-2025-058 8 CVEs
MB connect line: Multiple vulnerabilities in mbNET.mini
Multiple vulnerabilities in all mbNET.mini devices with firmware <= 2.3.2 that allow an attacker to gain full control over the device.
-
Critical max 7.2VDE-2025-059 8 CVEs
Helmholz: Multiple vulnerabilities in REX 100
Multiple vulnerabilities in all REX 100 devices with firmware <= 2.3.2 that allow an attacker to gain full control over the device.
-
Critical max 9.8
PHOENIX CONTACT: Security Advisory for multiple Industrial Controllers
Phoenix Contact Classic Line industrial controllers (ILC1x0 and ILC1x1 product families as well as the AXIOLINE controllers AXC1050 and AXC3050) are developed and designed for the use in closed industrial networks. The communication protocols used for device …
first Aug 7, 2019 -
Critical max 9.8
Festo: Controller CECC-S,LK,D family firmware 2.4.2.0 - multiple vulnerabilities in CODESYS V3 runtime system
The Festo controller CECC product family in firmware version 2.4.2.0 is affected by multiple vulnerabilities in the CODESYS V3 runtime.
first Jul 18, 2022 -
Critical max 8.8VDE-2025-054 4 CVEs
Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware
Multiple vulnerabilities in the PLCnext system allowed low-privileged remote attackers to gain unauthorized access or trigger system reboots by manipulating configuration files and symbolic links. Affected services include watchdog, arp-preinit, and security-…
-
Critical max 9.8VDE-2025-053 54 CVEs
Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware
Multiple Linux component vulnerabilities fixed in latest PLCnext Firmware release 2025.0.2
-
Critical max 10.0
WAGO: Vulnerability in WAGO Device Sphere
During installation, identical certificates are installed across all systems instead of unique ones, which are intended for JWT Token encryption and signing.
first Jun 23, 2025 -
Critical max 9.8PPSA-2025-003 1 CVE
Pilz: Authentication Bypass in IndustrialPI Webstatus
The Pilz industrial PC IndustrialPI webstatus application is vulnerable to an authentication bypass.
-
Critical max 10.0PPSA-2025-002 1 CVE
Pilz: Missing Authentication in Node-RED integration
Authentication is not configured by default for the Node-RED server on the Pilz industrial PC IndustrialPI. An unauthenticated remote attacker has full access to the Node-RED server and can run arbitrary operating system commands on the underlying operating s…
-
Critical max 9.8PPSA-2025-001 3 CVEs
Pilz: Authentication Bypass and Cross-Site-Scripting in PiCtory
PiCtory, a web application to configure the Pilz industrial PC IndustrialPI, has three vulnerabilities with varying degrees of severity. The first two are of critical severity and can lead to a bypass of authentication and a cross-site-scripting attack. The t…
-
Critical max 8.2VDE-2025-034 1 CVE
Vulnerabilities in mbCONNECT24/mymbCONNECT24
The mb24api endpoint reachable when connected via VPN is missing authentication for sensitive functions. This can lead to information disclosure of user- and device names and to DoS.
-
Critical max 7.5VDE-2025-035 2 CVEs
Vulnerabilities in mbCONNECT24/mymbCONNECT24
Two vulnerabilities in mbCONNECT24/mymbCONNECT24 can lead to user enumeration an password bypass.
-
Critical max 8.2VDE-2025-037 1 CVE
Vulnerabilities in myREX24/myREX24.virtual
The mb24api endpoint reachable when connected via VPN is missing authentication for sensitive functions. This can lead to information disclosure of user- and device names and to DoS.
-
Critical max 7.5VDE-2025-038 2 CVEs
Vulnerabilities in myREX24/myREX24.virtual
Two vulnerabilities in myREX24/myREX24.virtual can lead to user enumeration an password bypass.
-
Critical max 9.8
Festo: CECC-X-M1 - command injection vulnerabilities
The Festo controller CECC-X-M1 product family in multiple versions are affected by a preauthentication command injection vulnerability. Update A, 2022-07-05 Remediation has been updated. Fixed firmwares are now available.
first Jul 6, 2022